Failover command is incorrectly triggered on standby backend failure in v4.3.1

[jaewan-choi-0826]

Hello Pgpool Team,

I am experiencing an issue with Pgpool-II version 4.3.1.

Environment:

• Pgpool-II Version: 4.3.1
• PostgreSQL Nodes: 2 nodes
• Mode: Streaming Replication
• Configuration: load_balance_mode is on.
• backend_weight is set to 1:0 (all traffic is directed to the primary).

Problem Description:
In this configuration, when I either stop the PostgreSQL service on the standby backend or disconnect its network, Pgpool-II incorrectly executes the failover_command.

At the same time, my application is unable to connect to the database, and I see log messages like "executing failover on backend".

My Question:
I don't understand why the failover_command is being executed when it is the standby backend that fails, not the primary. This process blocks my application from accessing the database.

Under what circumstances could this behavior occur?

Please let me know if you need any more information. Any help would be greatly appreciated.

Thank you.

[koshino-235]

This is the expected behavior of Pgpool-II.
Even if a standby server goes down, the failover_command will be executed.
During this process, the application's access to the database will be blocked.

Version 4.3.1 is vulnerable to CVE-2025-46801.
We recommend upgrading to a version that is not affected by this vulnerability.
For more details, please refer to the following:
https://www.pgpool.net/docs/43/en/html/release-4-3-15.html

[jaewan-choi-0826]

Thank you for your response.
We'll update the version as soon as possible.

We are wondering how we should configure our system to achieve a zero-downtime database.
Frankly, we assumed that even if the Standby node went down, it wouldn't impact the database's availability.

We are aware of a setting, failover_on_backend_shutdown, which is supposed to prevent a failover from being triggered during an "admin shutdown." We set this value to off, expecting that a failover would not be initiated. However, we observed that a failover was ultimately triggered via the heartbeat mechanism.

We'd like to know if this is the expected behavior. If so, what is the intended purpose of the failover_on_backend_shutdown setting?

Thank you again.

[koshino-235]

Even when failover_on_backend_shutdown is set to off, failover can still occur due to the health check mechanism.

Setting failover_on_backend_shutdown to off ensures that failover occurs only during an admin shutdown.
In PostgreSQL, both an admin shutdown and terminating a session using pg_terminate_backend() return the same error code 57P01, which causes pgpool-II to trigger a failover.
When failover_on_backend_shutdown is on, a failover will also occur if a session is terminated by pg_terminate_backend().
However, terminating a session with pg_terminate_backend does not stop the server itself, so any failover that occurs in this case is unintended.
Setting failover_on_backend_shutdown to off prevents failover from being triggered by pg_terminate_backend() and ensures that it occurs only during an admin shutdown.

[koshino-235]

During a standby failover, not all client connections are disconnected. Only new connections will encounter errors, while existing connections will be maintained depending on the configuration.
If you want to maintain existing connections, you need to disable load balancing by setting load_balance_mode to off.